Hi,
VMnat.exe is indeed from VMware and -to my surprise- it is actually running from the Windows\SysWow64 folder.
That's considered bad practice to install any of your applications under the windows folder, so I can't blame you for wondering if it is malware.
You can verify if it is a valid binary by checking the signature.
Like so:
The VMNat file is the one that takes care about your internet connection that is being given to the VM.
It does this when you have selected "NAT: Used to share the host's IP Address" for your network adapter.
--
Wil